Google Chrome Permission Prompts UI Spoofing Vulnerability

A vulnerability allowing UI spoofing through a crafted Chrome extension has been identified in Google Chrome. This issue affects versions prior to 134.0.6998.35. The vulnerability arises from an inappropriate implementation in permission prompts, which could be exploited by an attacker to convince a user to install a malicious extension.

Impact

Exploitation of this vulnerability could lead to a UI spoofing attack, where an extension popup could obscure important permission prompts, such as those related to WebUSB access.

Reproduction

To reproduce this vulnerability, install a malicious Chrome extension designed to exploit the issue. Once the extension is installed, click anywhere on the page and press Ctrl+A. This action will trigger the extension popup, which can then appear over the WebUSB permission prompt, effectively obscuring it.

Remediation

Users can update to Google Chrome version 134.0.6998.35 or later to address this vulnerability.